Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward PoYo API helper that sends reviewed music-style prompts to PoYo using a user-provided API key.
Install this only if you intend to use PoYo's API. Treat any payload file as data that will be uploaded to api.poyo.ai, keep POYO_API_KEY private, and avoid sending confidential campaign, customer, or proprietary music direction unless that sharing is acceptable.
The skill declares shell-capable execution requirements via curl but does not restrict tool scope with explicit permissions or allowed-tools. In agent environments, this can enable broader-than-necessary command execution or make the runtime policy ambiguous, increasing the chance of misuse or unsafe invocation paths.
The manifest description advertises very broad usage terms such as music prompt enhancement, genre and mood expansion, and music detail retrieval without clear scope boundaries. In systems that auto-route by description, this can overmatch unrelated prompts and send user content to an external API more often than intended.
The trigger language is broad enough that the skill may activate for ordinary music-related requests, not just for explicit PoYo prompt-enhancement workflows. Unintended invocation can cause unnecessary external data transfer, surprise API usage, or execution in contexts where the user did not ask to call a third-party service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer $POYO_API_KEY" \
--header "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
The script performs an HTTP POST to an external API and transmits the contents of the user-supplied payload file along with an authorization header derived from an environment variable. While usage is shown, there is no confirmation prompt, visible user-facing notice, or explanatory comment/docstring warning that local data and credentials will be sent to a remote service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"$1"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"$1"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"$1"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"$1"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
: "${POYO_API_KEY:?POYO_API_KEY is required}"
curl --fail-with-body --request POST \
--url "https://api.poyo.ai/api/generate/submit" \
--header "Authorization: Bearer ${POYO_API_KEY}" \
--header "Content-Type: application/json" \
--data @"$1"
No suspicious patterns detected.